[Unit]
Description=Cloud IP Validator - Validator Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=cloud-ip-validator
Group=cloud-ip-validator
ExecStart=/usr/local/bin/validator-agent -config /etc/cloud-ip-validator/validator-agent.yaml
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
# Unprivileged ICMP echo requires either root or CAP_NET_RAW; grant only
# the latter rather than running the agent as root.
AmbientCapabilities=CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_RAW
ProtectSystem=strict
PrivateTmp=true

[Install]
WantedBy=multi-user.target